An improper neutralization of special elements used in an OS...

7.1 CVSS

Vulnerability Description

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-40679

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://fortiguard.com/psirt/FG-IR-22-335

More from Fortinet

View All →

CVE-2025-68686

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability...

Medium 5.3

CVE-2025-68649

An improper limitation of a pathname to a restricted directory...

Medium 5.4

CVE-2025-68648

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer...

Medium 6.5

CVE-2025-68482

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through...

Medium 6.3

CVE-2025-67862

An Internal Asset Exposed to Unsafe Debug Access Level or...

Medium 6

Affected Vendor

Fortinet

View all reports →

Affected Software

FortiDDoS, FortiDDoS-F, FortiADC

Vulnerable Versions:

5.6.0, 5.5.0, 5.4.0, 5.3.0, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.1, 4.1.1, 4.0.0, 6.4.0, 6.3.0, 6.2.0, 6.1.0, 7.1.0, 7.0.0, 6.0.0